CVE-2026-68955

⚠️ NEW VULNERABILITY: Japan's JPCERT/CC vulnerability program has disclosed a Windows installer flaw in Rakuten Kobo Desktop that can execute attacker-controlled code with the privileges of the user running the installer.

CVE:

CVE-2026-68955

CVSS v4:

8.4 HIGH

CyberSignal Priority: 🟠 HIGH 📅 August 27, 2026 🏷️ Windows · DLL Hijacking · Software Distribution · Rakuten Kobo 🆔 CVE-2026-68955 🔬 JVN / JPCERT/CC

The problem is not inside:

the ebook reader itself.

It exists in:

THE INSTALLATION PROCESS.

Affected Kobo Desktop installers use an unsafe:

DLL SEARCH PATH.

If a malicious DLL is placed in the same directory as the vulnerable installer:

victim launches legitimate installer ↓ Windows searches for required DLL ↓ attacker-controlled DLL discovered ↓ malicious DLL loaded ↓ code executes as:

THE USER RUNNING THE INSTALLER.

This is classic:

DLL search-order hijacking.

JVN says the vulnerability affects Windows installers distributed:

BEFORE JULY 15, 2026.

The issue is tracked as:

CVE-2026-68955

CWE-427 — Uncontrolled Search Path Element.

CVSS:

8.4 under CVSS v4

7.8 under CVSS v3.

This is NOT:

remote unauthenticated RCE.

The attacker needs a crafted DLL to already be present in the relevant directory.

And:

USER INTERACTION IS REQUIRED.

The victim must execute the affected installer.

JVN also makes another important point:

if Kobo Desktop is already installed:

YOU DO NOT NEED TO REINSTALL IT.

The vulnerable behavior exists when:

the installer runs.

If installing Kobo Desktop on Windows:

use the latest installer from the official vendor.

For enterprise defenders, this is also a useful hunting pattern:

trusted installer + unexpected DLL in download/temp directory + child execution.

Attackers often don't need to replace:

THE TRUSTED EXECUTABLE.

They only need to control:

WHAT THE TRUSTED EXECUTABLE LOADS.

Sources: Japan Vulnerability Notes · JPCERT/CC · IPA